Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add lync-cyber/CataForge --skill penpot-bridgegit clone --depth 1 https://github.com/lync-cyber/CataForgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lync-cyber/cataforge/penpot-bridge)<a href="https://agentmods.dev/skills/lync-cyber/cataforge/penpot-bridge"><img src="https://agentmods.dev/badge/skills/lync-cyber/cataforge/penpot-bridge.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00122 | $0.02333 |
| Opus 5 | $0.00061 | $0.01167 |
| Sonnet 5 | $0.00024 | $0.00467 |
| Haiku 4.5 | $0.00012 | $0.00233 |
Grade B, and why
penpot-bridge scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads MCP configurationmediumAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
具体 MCP 工具名以平台 MCP 配置为准(Claude: `.mcp.json` / `.claude/settings.json`;Cursor: `.cursor/mcp.json`;OpenCode: `opencode.json`),运行时按可用工具列表自动发现。典型操作:读项目信息、读组件结构/样式/SVG、读写设计 Token、导出组件图像(export_shape)。工具列表中无 Penpot 工具时先 `catafo How it starts
The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Penpot 设计↔代码桥 (penpot-bridge)
能力边界
- 能做: 读 Penpot 组件结构/样式/Token 实值;Token 双向同步(ui-spec ↔ Penpot ↔ tokens.css);从 Penpot 设计生成组件代码骨架;设计↔代码视觉一致性校验
- 不做: 需求/架构/页面信息设计(由 ui-design 负责);业务逻辑/状态管理/API 对接(由 TDD GREEN 负责);修改 ui-spec 语义契约
权威划分(语义 vs 视觉实值)见 ui-spec 模板「权威源约定」。
前置条件(所有操作共用)
- {INSTRUCTION_FILE}
设计工具字段为penpot - Penpot MCP 可用(见 §Penpot MCP 接入);不可用时返回 blocked,不静默 success
输入规范
- read: UC-{NNN} 或 Penpot 组件名
- sync: ui-spec#§1 设计系统 Token + sync-direction ∈ {emit, mirror, ingest}
- generate: ui-spec#§2 UC-{NNN}(Props/变体/交互——语义)+ arch#§1.4 技术栈 + Penpot 组件设计数据(视觉,经 read)
- verify: Penpot 组件设计数据(视觉权威源,经 read)+ 已实现组件代码路径 + ui-spec#§2 UC-{NNN}(语义参照)
输出规范
- read: 组件层级结构 / CSS 属性 / Token 实值 + 组件导出图像(供其他操作复用)
- sync:
src/styles/tokens.css(W3C Design Tokens 格式)+ 同步差异报告 - generate: 组件骨架文件(按 arch 技术栈)+ 样式文件(引 tokens.css 变量)
- verify: 设计一致性审查报告
docs/reviews/design/DESIGN-REVIEW-{component_id}-r{N}.md(差异列表 + 修复建议)
Penpot MCP 接入
具体 MCP 工具名以平台 MCP 配置为准(Claude: .mcp.json / .claude/settings.json;Cursor: .cursor/mcp.json;OpenCode: opencode.json),运行时按可用工具列表自动发现。典型操作:读项目信息、读组件结构/样式/SVG、读写设计 Token、导出组件图像(export_shape)。工具列表中无 Penpot 工具时先 cataforge penpot ensure(若未部署则 cataforge penpot deploy),仍不可用返回 blocked。
Plugin API 已知限制
程序化操作 Penpot 时以下限制不可绕过:
- 跨页移动/克隆无效 —
appendChild/insertChild跨页静默 no-op(不抛错、返回成功但 shape 仍在原页),clone()对非激活页 shape 返回 null,parent只读;已有 board 无法编程搬到另一页,只能人工在 UI 剪切粘贴 - shape 变更仅对激活页生效 — 对非当前激活页 board 的属性赋值静默 no-op;页面切换跨执行异步(同一次执行内 currentPage 不切换),程序化建 board / 排版必须「openPage 目标页 → 下一次执行再变更」两段式
- 无删页 API — 空页/误建页无法编程删除,仅能人工在 UI 删或改名复用;建页前先确定页数清单,宁可复用/回收,不误建
Penpot 文件组织约定(一规格一页)
design_tool=penpot 时视觉稿 authoring 按 ui-spec 结构一规格一页建页:设计系统 / 各页面规格 P-NNN / 组件库分别落独立 Penpot 页面,board 创作期即落对页。Plugin API 无法事后无损重组(§Plugin API 已知限制),页面骨架必须在创作期先建好;退化路径(generateMarkup → SVG 重建)丢失 flex 布局、设计 Token、组件实例链接与文本可编辑性,不可作为重组手段。
操作指令
read
读 Penpot 设计数据,供 sync/generate/verify 复用或独立做视觉 grounding。
- 经 MCP 读取组件层级结构(容器/子元素/文本/图标)
- 提取 CSS 属性(尺寸/颜色/字体/间距/边框)与 Token 实值
- 映射到 tokens.css 设计变量(优先变量而非硬编码值)
- 经 MCP
export_shape导出目标组件图像,供调用方做视觉自检(设计决策 / 还原度核对)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 93 lines · 122 tokens per session scan B 6f75e827c564
penpot-bridge is a skill published in the GitHub repository lync-cyber/CataForge (128 stars, last pushed 1mo ago), licensed MIT. It adds 122 tokens to every session and 2,333 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it B with 1 finding (reads mcp configuration). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
chakra-ui-builder
Build responsive, accessible UI components and layouts using Chakra UI v3, install or configure Chakra UI in new and existing projects, and design scalable themes using tokens, semantic tokens, recipes, and slot recipes. Use this skill whenever a user asks to build, create, or generate any UI component, page, form…
visual-ralph
Visual Ralph orchestration for frontend UI from generated references, static references, or live URL targets, using $ralph with built-in visual verdict and pixel-diff evidence until the implementation matches and leaves a reproducible design system.
frontend-visual-qa
Audits already-rendered web, landing-page, HTML deck/slide, browser tool/game, dashboard/admin, design-system, and desktop UIs using real-browser or native-app journeys, inspected screenshots, DOM geometry, responsive or projection viewports, and a bundled Playwright sweep. Use after UI implementation to find…
prototype-web
A clickable, high-fidelity web product prototype with navigation, a hero section, feature cards, steps, social proof, and optional pricing. It is designed to resemble a finished landing page while remaining a prototype.
animation-principles
Apply animation principles — easing, staging, follow-through — to one specific UI motion. Use when tuning how an animation feels. For product-wide duration and easing tokens use motion-system (design-systems); for a full interaction spec use micro-interaction-spec.
refactoring-ui
Audit and fix visual hierarchy, spacing, color, and depth in web UIs. Use when the user mentions "my UI looks off" (or amateur/unprofessional), "fix the design", "Tailwind styling", "color palette", "visual hierarchy", "design system", "spacing scale", or "component styling". Also trigger when building consistent…